Ingest Splunk HEC events

POST/services/collector/event

Ingests one or more Splunk HEC event envelopes, concatenated or newline-delimited, into an events or logs dataset. The dataset comes from the index query parameter, then the first event's index field, then the token's only ingest dataset.

Warning

Use this endpoint to ingest events through the Splunk HTTP Event Collector (HEC) compatible API. For a walkthrough, see Send data using the Splunk HEC API.

The base domain for this endpoint is hec. prefixed to the base domain of your edge deployment. For example, if your edge deployment’s base domain is us-east-1.aws.edge.axiom.co, the HEC endpoint is https://hec.us-east-1.aws.edge.axiom.co.

Edge deployment	Base domain for ingest and query
`US East 1 (AWS)`	`us-east-1.aws.edge.axiom.co`
`EU Central 1 (AWS)`	`eu-central-1.aws.edge.axiom.co`

This endpoint only supports API tokens. Personal access tokens (PATs) aren't supported. For more information, see Tokens.

Parameters

Property	Type	Location	Description
`index`	`string`	`query`	The dataset (Splunk index) to ingest into. Overrides the `index` field in the event envelope.

Body

A Splunk HEC event envelope.

application/json

Property	Type	Description
`event`	`unknown`	The event payload. When an object, its keys become top-level fields of the Axiom event. When a string, it is stored in the `_raw` field.
`fields`	`object`	Additional fields merged into the event.
`time`	`unknown`	The event timestamp, as epoch seconds, epoch milliseconds, or an RFC 3339 string. When omitted, Axiom assigns the ingest time.
`index`	`string`	The dataset (Splunk index) to ingest into. The `index` query parameter takes precedence.
`host`	`string`
`source`	`string`
`sourcetype`	`string`

Request

curl -X POST 'https://hec.{axiom-domain}/services/collector/event' \
  -H 'Authorization: Bearer API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"event":{"message":"hello from HEC","severity":"INFO"},"sourcetype":"httpevent"}'

Try itRun this request against your Axiom organization

Credentials stay in this browser tab and are only sent to Axiom when you run the request.

API token Requiredindex queryRequest body application/json

Response

200The events were accepted.

application/json

400The request can't be processed. `code` is `5` (no data), `6` (invalid data format, or the dataset is in another edge deployment or isn't an events or logs dataset), or `7` (no dataset could be resolved).

application/json

401The token is missing (`code` `2`) or invalid (`code` `3`).

application/json

403The token can't ingest into the dataset, the dataset is shared, or the organization is suspended. `code` is `4`.

application/json

404Dataset not found. `code` is `7`.

application/json

Property	Type	Description
`text`	`string`Required	A human-readable status message.
`code`	`integer`Required	The Splunk status code. `0` indicates success, `17` indicates a healthy collector, and `5`, `6`, and `7` indicate no data, invalid data format, and incorrect index respectively.